Search

This paper proposes a machine learning model based on the co-existence of static features for Android malware detection. The proposed model assumes that Android malware requests an abnormal set of co-existed permissions and APIs in comparing to those requested by benign applications. To prove this assumption, the paper created a new dataset of co-existed permissions and API calls at different levels of combinations, which are the second level, the third level, the fourth level and the fifth level. The extracted datasets of co-existed features at different levels were applied on permissions only, APIs only, permissions and APIs, and APIs and APIs frequencies. To extract the most relevant co-existed features, the frequent pattern growth (FP-growth) algorithm, which is an association rule mining technique, was used. The new datasets were extracted using Android APK samples from the Drebin, Malgenome and MalDroid2020 datasets. To evaluate the proposed model, several conventional machine learning algorithms were used. The results show that the model can successfully classify Android malware with a high accuracy using machine learning algorithms and the co-existence of features. Moreover, the results show that the achieved classification accuracy depends on the classifier and the type of co-existed features. The maximum accuracy, which is 98%, was achieved using the Random Forest algorithm and the co-existence of permissions features at the second combination level. Furthermore, the results show that the proposed approach outperforms the state-of-the-art model. Using Malgenome dataset, the proposed approach achieved an accuracy of about 98%, while the state-of-the-art achieved an accuracy of about 87%. In addition, the experiments show that using the Drebin dataset, the proposed approach achieved an accuracy of about 95%, while the state-of-the-art achieved an accuracy of about 93%.

One of the most challenging tasks in association rule mining is that when a new incremental database is added to an original database, some existing frequent itemsets may become infrequent itemsets and vice versa. As a result, some previous association rules may become invalid and some new association rules may emerge. We designed a new, more efficient approach for incremental association rule mining using a Fast Incremental Updating Frequent Pattern growth algorithm (FIUFP-Growth), a new Incremental Conditional Pattern tree (ICP-tree), and a compact sub-tree suitable for incremental mining of frequent itemsets. This algorithm retrieves previous frequent itemsets that have already been mined from the original database and their support counts then use them to efficiently mine frequent itemsets from the updated database and ICP-tree, reducing the number of rescans of the original database. Our algorithm reduced usages of resource and time for unnecessary sub-tree construction compared to individual FP- Growth, FUFP-tree maintenance, Pre-FUFP, and FCFPIM algorithms. From the results, at 3% minimum support threshold, the average execution time for pattern growth mining of our algorithm performs 46% faster than FP- Growth, FUFP-tree, Pre-FUFP, and FCFPIM. This approach to incremental association rule mining and our experimental findings may directly benefit designers and developers of computer business intelligence methods.